SCS-C02 Question 203
Select 3Your company operates a web application that follows a layered architecture with a public-facing Amazon CloudFront distribution, an Amazon Application Load Balancer (ALB), an Amazon EC2-based application layer, and an Amazon RDS database. A recent security review recommends improving defense-in-depth by restricting access to the application layer and protecting against potential attacks originating from the internet. What combination of steps should you take to enhance security in this architecture?
- A
Configure the Application Load Balancer to only accept requests originating from the Amazon CloudFront distribution.
- B
Use AWS WAF to create rules that block common web exploits and attach it to the Application Load Balancer.
- C
Enable VPC Flow Logs to monitor traffic between the application layer and the database layer.
- D
Restrict the security group of the Amazon EC2 instances to only allow traffic from the Application Load Balancer.
- E
Enable encryption in transit for the connection between the Amazon CloudFront distribution and the Application Load Balancer.
Show answer and explanation
Correct answers: A, B, D
Explanation
To enhance security in a layered web application architecture, it is critical to restrict access to application resources and implement protections against common web-based attacks. Configuring the ALB to accept traffic only from the CloudFront distribution ensures that all requests are routed through a secure and controlled entry point. Additionally, using AWS WAF to block common vulnerabilities and restricting EC2 security groups to traffic from the ALB further enhances defense-in-depth. Monitoring traffic with VPC Flow Logs and enabling encryption are helpful but do not directly address the core security recommendations.
- A. Correct.
Configuring the Application Load Balancer to accept requests only from the Amazon CloudFront distribution ensures that traffic is filtered through CloudFront, which acts as a layer of protection and caching. This limits exposure to direct internet traffic.
- B. Correct.
Using AWS WAF to block common web exploits, such as SQL injection or cross-site scripting (XSS), adds a strong layer of protection to the application by preventing malicious traffic from reaching the application layer.
- C. Incorrect.
While monitoring traffic with VPC Flow Logs can help with auditing and troubleshooting, it does not directly improve security at the application layer or against external attacks.
- D. Correct.
Restricting the security group of the Amazon EC2 instances to only allow traffic from the Application Load Balancer ensures that the application layer only receives traffic that has been validated and routed through the ALB.
- E. Incorrect.
While enabling encryption in transit between CloudFront and the ALB is a good practice for protecting data, it does not directly address the recommendation to enhance defense-in-depth or restrict access to the application layer.